Trust Center

SafeBase does not use Next.js middleware and is therefore not affected by CVE-2025-29927.

As a precautionary measure, we have deployed mitigations at the WAF level in accordance with GitHub's advisory notice.

On February 11th, Drata announced the acquisition of SafeBase. As part of the acquisition, SafeBase will be expanding our current subprocessors to include the following Drata subprocessors.

Prior to engaging any third party subprocessor, we perform diligence to evaluate subprocessor privacy, security, and confidentiality practices, and execute agreements implementing vendor’s applicable obligations.

Cloudflare

• Purpose: Content delivery network & WAF
• Location: United States

Amazon Web Services

• Purpose: Hosting & Infrastructure
• Location: United States, European Economic Area & Australia

Census

• Purpose: Reverse ETL
• Location: United States

Chameleon

• Purpose: Digital Adoption Platforms
• Location: United States

Decodable

• Purpose: ETL Solution for Product Data
• Location: United States, Germany & Australia

dbt Labs

• Purpose: Data Transformation and Modeling
• Location: United States

Liveblocks

• Purpose: End user collaboration.
• Location: United States

ProductBoard

• Purpose: Product feedback and prioritization
• Location: United States

Sigma Computing

• Purpose: Data Analytics & Visualization
• Location: United States

Snowflake

• Purpose: Data Warehouse
• Location: United States

SurveySparrow

• Purpose: Net Promoter Score
• Location: United States

Catalyst

• Purpose: Customer Success Management Platform
• Location: United States

Wiz

• Purpose: Cloud Security: Data Security Posture Management (DPSM)
• Location: United States

WorkOS

• Purpose: SSO Integration Connector
• Location: United States

Front

• Purpose: Unified Customer Messaging
• Location: United States

A complete list of subprocessors can be found on the Drata Trust Center and SafeBase Trust Center.

SafeBase is not affected by the Zapier security incident. More information on the incident can be found at: https://www.theverge.com/news/622026/zapier-data-breach-code-repositories

We have completed our latest SOC 2 Type 2 audit! The new report is available in our Trust Center.

SafeBase is not affected by the XZ Utils backdoor vulnerability.

Our security team has reviewed all OS versions deployed in our environment and confirmed that none of the impacted operating systems or versions are utilized.

For more details on this vulnerability, please visit https://nvd.nist.gov/vuln/detail/CVE-2024-3094 and https://www.darkreading.com/vulnerabilities-threats/are-you-affected-by-the-backdoor-in-xz-utils.